# Form data in body for Logstash HTTP filter

**URL:** <https://discuss.elastic.co/t/form-data-in-body-for-logstash-http-filter/332574>\
**Category:** Logstash\
**Created:** [May 4, 2023, 3:14pm UTC](https://discuss.elastic.co/t/form-data-in-body-for-logstash-http-filter/332574 "2023-05-04T15:14:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![analog\_memories](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/analog_memories/32/29982_2.png) [@analog\_memories](https://discuss.elastic.co/u/analog_memories)\
**Post date:** [May 4, 2023, 3:14pm UTC](https://discuss.elastic.co/t/form-data-in-body-for-logstash-http-filter/332574/1 "2023-05-04T15:14:17Z")

</div>

Hello,

I was wondering if anyone has had the syntax for using form data in the body of HTTP filter. I have tried all manor of ways to make it work, and searched the forums, but have not found anything.

[This](https://discuss.elastic.co/t/how-to-access-third-party-rest-api-using-http-poller-http-filter-and-ruby-filter-using-basic-authentication-header-and-body/202013/2) post is pretty similar, and I tried to use it, and it didn't work.

The error I am receiving:

```auto
The request body must contain the following parameter: 'grant_type'.

```

However, my filter code has the following:

```auto
    http {
        url => "webaddresshere"
        body_format => "text"
        verb => "POST"
        body => "'client_id=<clientid>'&'client_secret=<client_secret>'&'grant_type=client_credentials'&'scope=<scopeinfo>'"
    }

```

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![analog\_memories](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/analog_memories/32/29982_2.png) [@analog\_memories](https://discuss.elastic.co/u/analog_memories)\
**Post date:** [May 5, 2023, 8:39pm UTC](https://discuss.elastic.co/t/form-data-in-body-for-logstash-http-filter/332574/2 "2023-05-05T20:39:19Z")

</div>

Is this something that might be better handed with a Ruby script or some other external method?

Thanks

---

<div class="post-metadata">

**Author:** ![analog\_memories](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/analog_memories/32/29982_2.png) [@analog\_memories](https://discuss.elastic.co/u/analog_memories)\
**Post date:** [May 9, 2023, 7:18pm UTC](https://discuss.elastic.co/t/form-data-in-body-for-logstash-http-filter/332574/3 "2023-05-09T19:18:37Z")

</div>

Figured it out.  
Need to have headers for Content\_type and Content\_Length.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2023, 7:19pm UTC](https://discuss.elastic.co/t/form-data-in-body-for-logstash-http-filter/332574/4 "2023-06-06T19:19:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.